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1 . A method of reducing spread of data on a network, comprising: 

obtaining a spectral analysis of times of arrival of data packets at receiving nodes of said 
network from sending nodes of said network over predetermined time periods; 

for each pair of sending node and receiving node, marking transmissions of data packets 
for said pair as marked transmissions when said spectral analysis indicates peak frequencies 
associated with said marked transmissions are different from peak frequencies associated with 
others of said transmissions for said pair over a window of a predetermined number of said time 
periods; 

marking transmissions of data packets as interruptible transmissions when marked 
transmissions from pairs having at least one of a common sending node and a common receiving 
node and within a specified number of said windows have corresponding frequencies; 

estimating timing and length information for future data packets corresponding to said 
interruptible transmissions; and 

interrupting traffic of said future data packets based on said estimating. 

2. The method of claim 1, wherein obtaining a spectral analysis comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into said windows; and 
obtaining Lomb periodograms for said windows. 

3. The method of claim 1, wherein estimating comprises applying a Hidden Markov Model 
technique for classifying said interruptible transmissions as belonging to one of a plurality of 
classes of transmissions having determinable characteristics. 
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4. The method of claim 1, wherein interrupting comprises randomly removing data packets. 

5. The method of claim 4, comprising: 

interrupting for a specified time; and 

determining, after said specified time, if a further spectral analysis of times of arrival of 
data packets since beginning said interrupting indicates said peak frequencies associated with 
said marked transmissions. 

6. The method of claim 5, comprising returning to estimating based on said further spectral 
analysis when said further spectral analysis indicates said peak frequencies associated with said 
marked transmissions. 

7. The method of claim 4, wherein obtaining a spectral analysis comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into said windows; and 
obtaining Lomb periodograms for said windows. 

8. A method of reducing spread of data on a network, comprising: 

obtaining, at a receiver node of said network, periodograms based on times of arrival of 
data packets from a sender node of said network; 

comparing peak frequencies in successive ones of said periodograms for said sender node 
to determine if one of said periodograms includes a peak above a threshold at a frequency 
different from said peak frequencies in a preceding one of said periodograms; 

determining if at least one peak above said threshold at said frequency occurs in one of a 
predetermined number of previous periodograms for said sender node; 
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determining if said at least one peak at said frequency occurs in at least one of a specified 
number of periodograms obtained at said receiver node for other sender nodes of said network; 

estimating timing and length information for future data packets corresponding to said 
frequency when said at least one peak at said frequency does not occur in one of said 
predetermined number of previous periodograms for said sender node and when said at least one 
peak at said frequency occurs in at least one of said specified number of periodograms obtained 
at said receiver node for other sender nodes of said network; and 

interrupting traffic of said future data packets corresponding to said frequency based on 
said estimating. 

9. The method of claim 8, wherein obtaining said periodograms comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
obtaining Lomb periodograms for said windows. 

10. The method of claim 8, wherein said estimating comprises classifying a data stream for said 
at least one peak at said frequency based on said periodograms using a Hidden Markov Model. 

1 1 . The method of claim 8, wherein interrupting comprises: 

randomly removing data packets for a specified time; 

determining, after said specified time, if said at least one peak at said frequency occurs in 
at least one additional periodogram based on times of arrival of data packets since beginning said 
interrupting; and 

returning to estimating based on including said additional periodograms with said 
specified number of periodograms when said at least one peak at said frequency occurs in said at 
least one additional periodogram. 
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12. A method of reducing spread of data on a network, comprising: 

obtaining, at a router node of said network, periodograms based on times of arrival of 
data packets from a sender node of said network; 

comparing successive periodograms for said sender node to determine when at least one 
new peak above a threshold is present in one of said periodograms; 

determining if said at least one new peak occurs in one of a predetermined number of 
previous periodograms for said sender node; 

determining if said at least one new peak occurs in at least one of a specified number of 
periodograms obtained at said router node for other sender nodes of said network; 

estimating timing and length information for future data packets corresponding to said at 
least one new peak when said at least one new peak does not occur in one of a predetermined 
number of previous periodograms for said sender node and when said at least one new peak 
occurs in at least one of said specified number of periodograms obtained at said router node for 
other sender nodes of said network; and 

interrupting traffic of said data packets corresponding to said at least one new peak based 
on said estimating. 

13. The method of claim 12, wherein interrupting comprises randomly removing data packets 
for a specified time. 

14. The method of claim 13, wherein obtaining said periodograms comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
obtaining Lomb periodograms for said windows. 
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15. The method of claim 14, wherein said estimating comprises classifying a data stream for 
said at least one new peak based on said periodograms using a Hidden Markov Model. 

16. A method of classifying disruptive data packet traffic flow on a network, comprising: 

obtaining at a router, periodograms based on times of arrival of said data packets from 
nodes of said network; 

comparing successive periodograms for each of said nodes to determine when at least one 
new peak above a threshold is present in one of said periodograms for one of said nodes; 

marking said at least one new peak as a suspicious peak when said at least one new peak 
does not occur in one of a predetermined number of previous periodograms for said one of said 
nodes; 

determining if said suspicious peak occurs in at least one of a specified number of 
periodograms obtained at said router for others of said nodes of said network; 

determining if said suspicious peak occurs in at least one of said specified number of 
periodograms obtained at other routers for said one of said nodes; and 

providing a signal to classify traffic flow corresponding to said suspicious peak as 
disruptive traffic flow when said suspicious peak occurs at least in at least one of said specified 
number of periodograms obtained at said router for said others of said nodes and in at least one 
of said specified number of periodograms obtained at said other routers for said one of said 
nodes. 

17. A computer-readable medium containing instructions for controlling a processor to classify 
disruptive data packet traffic flow, by: 

obtaining at a router, periodograms based on times of arrival of said data packets from 
nodes of said network; 

comparing successive periodograms for each of said nodes to determine when at least one 
new peak above a threshold is present in one of said periodograms for one of said nodes; 
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marking said at least one new peak as a suspicious peak when said at least one new peak 
does not occur in one of a predetermined number of previous periodograms for said one of said 
nodes; 

determining if said suspicious peak occurs in at least one of a specified number of 
periodograms obtained at said router for others of said nodes of said network; 

determining if said suspicious peak occurs in at least one of said specified number of 
periodograms obtained at other routers for said one of said nodes; and 

providing a signal to classify traffic flow corresponding to said suspicious peak as 
disruptive traffic flow when said suspicious peak occurs at least in at least one of said specified 
number of periodograms obtained at said router for said others of said nodes and in at least one 
of said specified number of periodograms obtained at said other routers for said one of said 
nodes. 

18. The computer-readable medium of claim 17, further containing instructions for controlling 
said processor to obtain said periodograms, by: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
obtaining Lomb periodograms for said windows. 

19. The computer-readable medium of claim 17, further containing instructions for controlling 
said processor to provide a signal to classify traffic flow using a Hidden Markov Model. 

20. The computer-readable medium of claim 17, further containing instructions for controlling 
said processor to interrupt, by: 

randomly removing data packets for a specified time; 

determining, after said specified time, if said at least one peak at said frequency occurs in 
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at least one additional periodogram based on times of arrival of data packets since beginning said 
interrupting; and 

returning to estimating based on including said additional periodograms with said 
specified number of periodograms when said at least one peak at said frequency occurs in said at 
least one additional periodogram. 

21. A computer program, disposed on a computer-readable medium, for reducing spread of data 
on a network, said computer program including instructions for causing a processor to: 

obtain a spectral analysis of times of arrival of data packets at receiving nodes of said 
network from sending nodes of said network over predetermined time periods; 

for each pair of sending node and receiving node, mark transmissions of data packets for 
said pair as marked transmissions when said spectral analysis indicates peak frequencies 
associated with said marked transmissions are different from peak frequencies associated with 
others of said transmissions for said pair over a window of a predetermined number of said time 
periods; 

mark transmissions of data packets as interruptible transmissions when marked 
transmissions from pairs having at least one of a common sending node and a common receiving 
node and within a specified number of said windows have corresponding frequencies; 

estimate timing and length information for future data packets corresponding to said 
interruptible transmissions; and 

interrupt traffic of said future data packets based on said estimating. 

22. The computer program of claim 21, wherein said instructions to obtain a spectral analysis 
comprise instructions to: 

track times of arrival data; 

transform said times of arrival data into time-series; 
parse said time-series into said windows; and 
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23. The computer program of claim 21, wherein said instructions to estimate comprise 
instructions to apply a Hidden Markov Model technique to classify said interruptible 
transmissions as belonging to one of a plurality of classes of transmissions having determinable 
characteristics. 

24. The computer program of claim 21 , wherein said instructions to interrupt comprise 
instructions to randomly remove data packets. 

25. The computer program of claim 24, wherein said instructions to interrupt further comprise 
instructions to: 

interrupt for a specified time; and 

determine, after said specified time, if a further spectral analysis of times of arrival of 
data packets since beginning to interrupt indicates said peak frequencies associated with said 
marked transmissions. 

26. The computer program of claim 25, wherein said instructions to interrupt further comprise 
instructions to repeat said instructions to estimate based on said further spectral analysis when 
said further spectral analysis indicates said peak frequencies associated with said marked 
transmissions. 
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